BGH ruling on damages for data protection breaches

The ruling by the German Federal Court of Justice (BGH) on November 18, 2024 has put an abrupt end to years of uncertainty regarding the legal consequences of data breaches. The BGH ruled that even the mere loss of control over personal data constitutes immaterial damage that justifies a claim for damages. This decision marks a turning point in German data protection law and is also the first landmark decision by the BGH in this area. This not only means that the ruling is binding for all future proceedings, but also that it serves as a clear guideline for the lower courts. This ends a period of legal uncertainty in which courts have ruled differently on claims for damages in the event of data protection breaches.

The loss of control as damage: A clear cut

With this decision, the BGH has clarified that no specific misuse of the data is required in order to claim non-material damage. The mere loss of control over personal data is sufficient to justify a claim under Art. 82 GDPR. This clarification puts an end to a long discussion about whether data subjects must first prove that their data has actually been misused or that they are suffering the specific consequences of a data breach. With this ruling, the BGH has significantly strengthened consumer protection and paved the way for numerous claims for damages. At the same time, however, it has also set the amount of compensation at 100 euros – an amount that is likely to disappoint many of those affected. Although they are now entitled to compensation in principle, the sum is so low that it is hardly perceived as real compensation.

100 euros in compensation: a Pyrrhic victory for those affected?

Setting the compensation at just 100 euros raises questions: Is this amount really sufficient to compensate for the loss of control over personal data? For many of those affected, this amount is unlikely to justify the expense of legal proceedings. In the past, some higher regional courts have awarded higher sums, especially if sensitive data was affected or the breach had serious consequences. However, the new ruling by the BGH makes it clear that the days of high claims for damages are over. This also puts an end to the practice of some law firms that had advertised claims for damages of up to 3,000 euros in mass proceedings. These proceedings will become much less attractive in future – both for lawyers and for those affected.

The end of mass proceedings: A new chapter in data protection law

With the BGH ruling, the age of mass litigation in the area of data protection law should finally be over. In recent years, large law firms have increasingly brought class actions against companies, holding out the prospect of high compensation sums. However, with compensation set at just 100 euros per case, the financial interest in such proceedings will fall drastically. For many lawyers, it will simply no longer be worthwhile pursuing such proceedings on a large scale. The question also arises for the affected persons themselves as to whether they want to take on the expense of proceedings for a comparatively small amount of compensation. The ruling could therefore lead to fewer lawsuits being filed and companies being confronted with mass claims less frequently.

The landmark decision: What does it mean for future cases?

It is particularly noteworthy that this ruling is a landmark decision – the first of its kind in the area of data protection law by the Federal Court of Justice. A landmark decision has a special significance: it not only provides a clear guideline for all future decisions, but is also binding for all lower courts. In concrete terms, this means that regional and higher regional courts will have to follow this decision in future and will no longer be able to issue divergent rulings. For companies, this brings long-awaited legal certainty: they now know exactly what risk they run in the event of a data breach and can adapt their compliance measures accordingly.

For consumers: a mixed result

For consumers, the ruling is a double-edged sword: on the one hand, their position has been strengthened by recognizing the loss of control as damage – they no longer have to prove that their data has been misused or that they have suffered a specific breach. On the other hand, the awarded compensation of 100 euros is so low that many of those affected will probably refrain from filing a lawsuit. The question remains as to whether this sum is really sufficient to adequately compensate for the loss of control over personal data – especially when sensitive data is involved or the breach had serious consequences.

Conclusion: An ending with mixed feelings

The ruling of the Federal Court of Justice marks the end of an era in German data protection law and puts a clear end to the discussions about compensation for data protection breaches. With the first landmark decision in this area, the BGH has created legal certainty and at the same time put an end to the practice of mass lawsuits with high compensation claims. This is a relief for companies: they now know exactly what risk they are taking and can take appropriate measures. However, consumers are left with a mixed feeling: although their position has been strengthened, it remains questionable whether 100 euros is really enough to compensate for the loss of control over personal data.

The future will show whether further adjustments by the legislator or the European Court of Justice will be necessary in order to strike a balance between consumer protection and economic reality.